Red Hat Enterprise Linux 9.0

A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write into freed memory. This can lead to local privilege elevation on systems where the X server runs privileged and remote code execution for ssh X forwarding sessions.

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Perl: write past buffer end via illegal user-defined unicode property

Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space

Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty

A vulnerability was found in libcap. This issue occurs in the _libcap_strdup() function and can lead to an integer overflow if the input string is close to 4GiB.

Gimp: gimp integer overflow

Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free

Ansible: template injection

Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.

Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution

A stack-based buffer overflow flaw was found in the Fribidi package. This flaw allows an attacker to pass a specially crafted file to the Fribidi application, which leads to a possible memory leak or a denial of service.

Kernel: netfilter: potential slab-out-of-bound access due to integer underflow

Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Xorg: xwayland: buffer overflow in xkbchangetypesofkey()

Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c

Xorg: xwayland: buffer overflow in xkbvmodmasktext()

Xorg: xwayland: heap overflow in xkbwritekeysyms()

Libx11: integer overflow in xcreateimage() leading to a heap overflow

Xorg: xwayland: use of uninitialized pointer in compredirectwindow()

Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()

Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file

A flaw was found in KVM. When updating a guest's page table entry, vm_pgoff was improperly used as the offset to get the page's pfn. As vaddr and vm_pgoff are controllable by user-mode processes, this flaw allows unprivileged local users on the host to write outside the userspace region and potentially corrupt the kernel, resulting in a denial of service condition.

Gimp: gimp: heap buffer overflow due to integer overflow in fits image loader

X.org: xwayland: use-after-free of the root cursor

Xorg: xwayland: use-after-free in playreleasedevents()

Xorg: xwayland: use-after-free in syncinittrigger()

Buildah: buildah allows arbitrary directory mount

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted fits images

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform. This issue may lead to memory problems.

Xorg-x11-server: selinux context corruption

Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags

A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event_to_user(). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

Gimp: gimp: integer overflow in read_rle_channel()

Gimp: gimp: stack buffer overflow in pnmscanner_gettoken()

A flaw was found in the Linux kernel’s driver for the ASIX AX88179_178A-based USB 2.0/3.0 Gigabit Ethernet Devices. The vulnerability contains multiple out-of-bounds reads and possible out-of-bounds writes.

Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.